Change Details

**Feature summary**: MediaWiki should be inaccessible to anyone until any of the conditions are met: # There is no `LocalSettings.php` file detected. # The `mw-config` folder is deleted. # The setting `$wgEnableWebInstaller` is set to `true`. (By default, it will be set to `false` in `LocalSettings.php`.) **Use case(s)**: When MediaWiki is operating normally, i.e. it has already been set up and no upgrades or database updates are needed, there is no reason to access `mw-config/`. **Benefits**: Most system administrators either don't use `mw-config/` (because they use the `install.php` and `update.php` maintenance scripts) or use it and then forget to delete/hide `mw-config/`. Since there is no built-in access restriction for `mw-config/`, anyone can access it after the installation finishes, which poses a security hazard. Many other web applications already require the `admin/` folder or their `setup/` folder to either be renamed or completely deleted before the software can be used.

**Feature summary**: MediaWiki should be inaccessible to anyone until any of the conditions are met: # There is no `LocalSettings.php` file detected. # The `mw-config/` folder is deleted. # The setting `$wgEnableWebInstaller` is set to `true`. (By default, it will be set to `false` in `LocalSettings.php`.) I propose that the behavior for denying access to MediaWiki (to make it inaccessible) would be isomorphic to the current “MediaWiki is not installed” message, which is loaded by the Web Installer when a LocalSettings.php file is not detected. MediaWiki APIs should be disabled and index.php will continue to display this notice until one of the above criteria is met. It follows by transitivity that no user will be able to access the wiki pages, nobody will be able to log in, and the wiki cannot be modified in any way. The inaccessibility would be complete and uncompromising. **Use case(s)**: When MediaWiki is operating normally, i.e. it has already been set up and no upgrades or database updates are needed, there is no reason to access `mw-config/`. **Benefits**: Most system administrators either don't use `mw-config/` (because they use the `install.php` and `update.php` maintenance scripts) or use it and then forget to delete/hide `mw-config/`. Since there is no built-in access restriction for `mw-config/`, anyone can access it after the installation finishes, which poses a security hazard. Many other web applications already require the `admin/` folder or their `setup/` folder to either be renamed or completely deleted before the software can be used.

**Feature summary**: MediaWiki should be inaccessible to anyone until any of the conditions are met: # There is no `LocalSettings.php` file detected. # The `mw-config/` folder is deleted. # The setting `$wgEnableWebInstaller` is set to `true`. (By default, it will be set to `false` in `LocalSettings.php`.) I propose that the behavior for denying access to MediaWiki (to make it inaccessible) would be isomorphic to the current “MediaWiki is not installed” message, which is loaded by the Web Installer when a LocalSettings.php file is not detected. MediaWiki APIs should be disabled and index.php will continue to display this notice until one of the above criteria is met. It follows by transitivity that no user will be able to access the wiki pages, nobody will be able to log in, and the wiki cannot be modified in any way. The inaccessibility would be complete and uncompromising. **Use case(s)**: When MediaWiki is operating normally, i.e. it has already been set up and no upgrades or database updates are needed, there is no reason to access `mw-config/`. **Benefits**: Most system administrators either don't use `mw-config/` (because they use the `install.php` and `update.php` maintenance scripts) or use it and then forget to delete/hide `mw-config/`. Since there is no built-in access restriction for `mw-config/`, anyone can access it after the installation finishes, which poses a security hazard. Many other web applications already require the `admin/` folder or their `setup/` folder to either be renamed or completely deleted before the software can be used.